How LegalNexus handles your data
Written to meet India's Digital Personal Data Protection Act, 2023. Last updated 10 Nov 2026.
Who is responsible
LegalNexus is the Data Fiduciary for the account and platform data described below. You are the Data Principal. Advocates are separate fiduciaries for the professional records they keep about their own clients — their engagement with you is governed by their own duty of confidentiality and the Advocates Act.
What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email, mobile, city | To create and secure your account and let the other party identify you | Contract |
| Profile photo | Shown on listings and in your portal | Consent |
| Advocate bar registration, council, courts, fees | Verification and public listing | Contract · legitimate use |
| Appointments, case files, hearing dates, documents, messages | To run the matter between you and your advocate | Contract |
| Search terms (no account attached) | Aggregate trends only — the "Trending" page | Legitimate use |
| How often each advocate was shown, opened and booked (daily totals, no account attached) | So an advocate can see what their listing does, and so any future charge for featuring or placement can be shown to be worth it | Legitimate use |
We do not collect location, contacts, biometric data, or anything from your device beyond a session cookie. We do not run advertising or analytics trackers, and we do not sell or rent personal data to anyone.
When you open an advocate's profile from a list, we note in your own browser session which list it was, so the advocate can be told their listing was opened. It is the name of a page and an advocate's number, it is forgotten after half an hour, and it is never stored next to anything that identifies you.
Who can see what
- Public: an advocate's professional listing — name, photo, designation, practice areas, courts, fees, experience, rating and reviews.
- Only you and the other party: case files, hearing diary, uploaded documents, messages and appointment notes.
- Administrators: account records for verification, support and abuse handling. Admin actions are written to an audit log.
- Nobody else. There is no third-party data sharing, no ad network, and no export of user data to marketing tools.
Security measures
- Passwords are stored only as one-way bcrypt hashes — nobody, including us, can read them.
- Message bodies, case summaries, appointment notes, diary notes and document names are encrypted at rest with AES-256-GCM.
- Uploaded documents are stored outside the public web folder and served only after an access check, so a link cannot be shared or guessed into.
- Every form is CSRF-protected, sign-in is rate-limited, and session cookies are HTTP-only, SameSite and Secure over HTTPS.
- The site is served over TLS; uploads may not be executed as code.
If a breach affecting personal data occurs, we will notify the Data Protection Board and affected users as required by the DPDP Act.
How long we keep it
Account and matter records are kept while your account is open, because both sides of a matter need the history. Search logs are aggregated and pruned after 12 months. When you close your account we erase your profile, photo and messages, and irreversibly anonymise your name on shared case records that the advocate is professionally obliged to retain.
Your rights
Under the DPDP Act you may access your data, correct it, have it erased, nominate someone to act for you, and raise a grievance. The first two you can do yourself, right now.
Grievances
Write to the Grievance Officer at privacy@legalnexus.in with your registered email and what went wrong. We respond within 7 working days and resolve within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.
LegalNexus is a listing and practice-management platform. It does not provide legal advice, does not take a commission on advocate fees, and is not a party to the engagement between a client and an advocate.